Examkin

Soru

Zorluk: Çok zorImproving Operational Excellence via Monitoring and Logging

An enterprise runs a critical application on Amazon EC2 instances within an Auto Scaling group in a Production AWS account. The application generates business logs located at `/var/log/app/transaction.log`. These logs are rotated hourly and renamed using the format `/var/log/app/transaction.log-YYYYMMDD-HH`. The company's compliance policy requires that all logs be consolidated into a centralized Amazon OpenSearch Service domain managed in a dedicated Security AWS account. The solution must ensure zero data loss during log file rotations, tolerate downstream OpenSearch Service ingestion throttling or outages, and adhere strictly to the principle of least privilege. Which of the following approaches is the MOST operationally excellent and secure way to implement this logging architecture?

  1. Configure the CloudWatch agent on the EC2 instances with the log path set to `/var/log/app/transaction.log*` to monitor active and rotated log files. Send the logs to a local CloudWatch log group. In the Security account, create a CloudWatch Logs destination resource pointing to a local Kinesis Data Firehose delivery stream, and attach an access policy allowing the Production account to publish to it. In the Production account, create a CloudWatch Logs subscription filter on the log group pointing to the Security account's destination ARN. Configure the Kinesis Data Firehose stream to deliver logs to the Amazon OpenSearch Service domain and write failed documents to an S3 backup bucket in the Security account.Cevap
  2. B
    Configure the CloudWatch agent on the EC2 instances with the log path set to `/var/log/app/transaction.log` to track the active log stream. Send the logs to a local CloudWatch log group. In the Security account, create a CloudWatch Logs destination resource pointing to a local Kinesis Data Firehose delivery stream, and attach an access policy allowing the Production account to publish to it. In the Production account, create a CloudWatch Logs subscription filter on the log group pointing to the Security account's destination ARN. Configure the Kinesis Data Firehose stream to deliver logs to the Amazon OpenSearch Service domain and write failed logs to an S3 backup bucket in the Security account.
  3. C
    Configure the CloudWatch agent on the EC2 instances with the log path set to `/var/log/app/transaction.log*` and configure the agent to publish logs directly to a Kinesis Data Firehose delivery stream in the Security account. Create an IAM role in the Production account that attempts to assume a role in the Security account to write directly to Firehose, but do not configure any CloudWatch log groups in the Production account to act as a buffer or local log cache.
  4. D
    Configure the CloudWatch agent on the EC2 instances with the log path set to `/var/log/app/transaction.log*` and publish logs to a local CloudWatch log group in the Production account. Create a Kinesis Data Firehose delivery stream in the Production account that delivers logs directly to the Amazon OpenSearch Service domain in the Security account. Configure Kinesis Data Firehose to write failed documents to an S3 bucket in the Security account, and apply a bucket policy that grants `s3:PutObject` to the Production account IAM role but omits the `s3:PutObjectAcl` permission required to grant bucket owner full control.

Cevap

The correct approach is to configure the CloudWatch agent with a wildcard path to capture rotated files, publish to a local CloudWatch log group, stream to a cross-account CloudWatch Logs destination in the Security account, and use Kinesis Data Firehose in the Security account to route to OpenSearch and back up failed documents to an S3 bucket in the same account.
The correct approach utilizes a wildcard pattern `/var/log/app/transaction.log*` in the CloudWatch agent config to ensure rotated logs are captured. It routes logs via a local CloudWatch log group to a cross-account CloudWatch Logs destination, which then writes to a Kinesis Data Firehose delivery stream in the Security account. Firehose natively buffers the logs, handles OpenSearch ingestion, and writes failed deliveries to an S3 backup bucket in the same Security account, avoiding complex cross-account S3 write permissions.

Adım Adım Çözüm

1
Specify the wildcard log path `/var/log/app/transaction.log*` in the CloudWatch agent configuration.
The CloudWatch agent continuously monitors both the active transaction log and any newly rotated log files, preventing log loss during rotation.
Log rotation renames active files, which would cause a static configuration path to miss logs during transition.
2
Publish logs from the EC2 instances to a local CloudWatch log group in the Production account, and create a cross-account CloudWatch Logs destination in the Security account.
Logs are buffered locally in the Production account, and a secure cross-account subscription path is established to the Security account.
This isolates account-level operational data and provides a native, secure transfer mechanism using AWS service-to-service IAM permissions.
3
Create a subscription filter in the Production account pointing to the Security account's destination ARN, routing logs to Kinesis Data Firehose and Amazon OpenSearch Service in the Security account.
Logs are streamed in real time to Kinesis Data Firehose, which buffers them and delivers them to the OpenSearch Service domain. Failed deliveries are captured in a local S3 backup bucket in the Security account.
This ensures that OpenSearch Service scaling or outages do not lead to log loss, as Firehose buffers and retries, eventually backing up failures to S3 without cross-account write complexities.

Anahtar Kavram

Cross-account centralized logging using CloudWatch Logs subscription filters, CloudWatch Logs destinations, and Kinesis Data Firehose backup paths.
Bu soruyu puanla

Konular

Improving Operational Excellence via Monitoring and Logging